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ABSTRACT 

The problem of finding quantum-error-correcting codes is transformed into the problem of 
finding additive codes over the field GF{A) which are self-orthogonal with respect to a certain 
trace inner product. Many new codes and new bounds are presented, as well as a table of 
upper and lower bounds on such codes of length up to 30 qubits. 
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1. Introduction 



The relationship between quantum information and classical information is a subject cur- 
rently receiving much study. While there are many similarities, there are also substantial 
differences between the two. Classical information cannot travel faster than light, while quan- 
tum information appears to in some circumstances (although proper definitions can resolve 
this apparent paradox). Classical information can be duplicated, while quantum information 



cannot J29||, JF2|. 

It is well known that classical information can be protected from degradation by the use of 
classical error-correcting codes |p2fl . Classical error-correcting codes appear to protect classical 
information by duplicating it, so because of the theorem that a quantum bit cannot be cloned, 
it was widely believed that these techniques could not be applied to quantum information. 
That quantum-error-correcting codes could indeed exist was recently shown by one of us fl60[ . 
Two of us [JD]] then showed that a class of good quantum codes could be obtained by using a 
construction that starts with a binary linear code C containing its dual C 1 - . Independently, 



Steane also discovered the existence of quantum codes |68[ and the same construction ||67[ • At 
around the same time, Bennett et al. [Q] discovered that two experimenters each holding one 
component of many noisy Einstein-Podolsky-Rosen (EPR) pairs could purify them using only 
a classical channel to obtain fewer nearly perfect EPR pairs. The resulting pairs can then be 
used to teleport quantum information from one experimenter to the other |J. Although it 
was not immediately apparent, these two discoveries turned out to be different ways of looking 
at the same phenomenon. A purification protocol that uses only a one-way classical channel 
between the experimenters can be converted into a quantum-error-correcting code, and vice 
versa ||. After these discoveries, a number of improved quantum codes were soon found by 
various researchers. 

The setting in which quantum-error-correcting codes exist is the quantum state space of n 
qubits (quantum bits, or two-state quantum systems). This space is C 2 ™, and it has a natural 
decomposition as the tensor product of n copies of C 2 , where each copy corresponds to one 
qubit. We noticed that the known quantum codes seemed to have close connections to a finite 
group of unitary transformations of C 2 ™, known as a Clifford group, and denoted here by L. 
This group contains all the transformations necessary for encoding and decoding quantum 
codes. It is also the group generated by fault-tolerant bitwise operations performed on qubits 



that are encoded by certain quantum codes |fl7fl , [pi] ], |]S7| ]. Investigation of the connection 
between this group and existing quantum codes has led us to a general construction for such 
codes which allows us to generate many new examples. The initial results of this study were 
reported in [16]. However, it is very hard to construct codes using the framework of [16]. In 



the present paper we develop the theory to the point where it is possible to apply standard 
techniques from classical coding theory to construct quantum codes. Some of the ideas in |]16[ 
(although neither the connections with the Clifford group nor with finite geometries or fields) 
were discovered independently by Gottesman J35| . 

The paper is arranged as follows. Section 2 transforms the problem into one of constructing 
a particular type of binary space (Theorem |l]). Section 3 shows that these spaces in turn are 
equivalent to a certain class of additive codes over GF(4) (Theorem^. The rest of the paper is 
then devoted to the study of such codes. Their basic properties are described in the remainder 
of Section 3, and Section 4 gives a number of general constructions. Sections 5, 6, and 7 then 
deal with cyclic and related codes, self-dual codes, and bounds. Until now little was known 
about general bounds for quantum codes. The linear programming bound (Theorems ^ and 
|22| ) presented in Section 7 appears to give quite sharp bounds for those codes. This can be seen 
in the main table of the paper, Table III, given in Section 8, which is based on the results of 
the earlier sections. Although there are still a large number of gaps in the table, the upper and 
lower bounds are generally not too far apart and there are a considerable number of entries 
where the parameters of the best codes are known exactly. Section 9 contains an update on 
developments that have occurred since the manuscript of this paper was first circulated. 

In order to reduce the length of the paper, proofs which either use standard techniques in 
coding theory or are straightforward will be omitted. 

2. From quantum codes to binary spaces 

Recall from Section 1 that the quantum state space of n qubits is C 2 ™ . The idea behind 
quantum error correction is to encode quantum states into qubits so that errors or decoherence 
in a small number of individual qubits will have little or no effect on the encoded data. More 
precisely, an encoding of k qubits into n qubits is taken to be a linear mapping of C onto a 
2 fc -dimensional subspace of C 2 ™ . Since the error correction properties of this mapping depend 
only on the subspace rather than on the mapping, the subspace itself will be called the quantum 
error correcting code. 
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Correction of arbitrary errors in an arbitrary 2 fc -dimensional subspace is in general infea- 
sible, since errors which map states in the subspace to other states in the subspace cannot be 
corrected (because the latter are also permissible states). To overcome this, we make use of 
the tensor product decomposition of C 2 ™ into n copies of C 2 . Quantum error correcting codes 
are subspaces oriented so that any error in a relatively small number of qubits moves the state 
in a direction perpendicular to the coded subspace, and thus can be corrected. 

A bit error in an individual qubit corresponds to applying the Pauli matrix a x = (® ^ 
to that qubit, and a phase error to the Pauli matrix a z = The third Pauli matrix, 

a v = (i "o*) = '^^i corresponds to a combination of bit and phase errors. The group E of 
tensor products ±w\ (g> • • • (g) w n and ±iw\ (g) ■ ■ • <g> w n , where each Wj is one of /, a x , cr y , cr z , 
describes the possible errors in n qubits. E is a subgroup of the unitary group U(2 n ). In 
general, there is a continuum of possible errors in qubits, and there are errors in sets of qubits 
which cannot be described by a product of errors in individual qubits. For the purposes of 
quantum error correction, however, we need consider only the three types of errors a x , a y 
and a z , since any error-correcting code which corrects t of these errors will be able to correct 
arbitrary errors in t qubits [|[], [33], [45]. We do not go into the details of this result, but 
essentially it follows from the fact that the matrices /, a x , a y and <r z form a basis for the space 
of all 2 x 2 matrices, and so the tensor products of t of these errors form a basis for the space 
of 2* x 2* matrices. 

Our codes will thus be tailored for the error model in which each qubit undergoes indepen- 
dent errors, and the three errors a x , a y and a z are all equally likely. The results of J|], |^3| , 
[45] show that any code which corrects these types of quantum errors will be able to correct 
errors in arbitrary error models, assuming the errors are not correlated among large numbers of 
qubits and that the error rate is small. For other error models it may be possible to find codes 
which correct errors more efficiently than our codes do; this is not discussed in this paper. 

This section and Section 3 show how to convert the problem of finding quantum-error- 
correcting codes into one of finding certain types of classical error-correcting codes. We do 
this in two stages. The first stage reduces the problem from a quantum (continuous) one to a 
classical (discrete) problem in finite geometry. The second stage converts the latter to a coding 
theory problem. 

The finite geometry problem can be summarized as follows. Let E denote a 2n-dimensional 
binary vector space, whose elements are written (a\b) and which is equipped with the inner 
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product 

((a\b),(a'\b')) = a-b' + a' -b . (1) 
This is a symplectic inner product, since it satisfies 

((a|6),(o|6))=0. 

Define the weight of (a\b) = (ai • • • a n \b\ ■ ■ ■ b n ) to be the number of coordinates i such that at 
least one of a, and bi is 1. The distance between two elements (a\b), (a'\b') G E is defined to 
be the weight of their difference. 

Then we have the following theorem, which is an immediate consequence of Theorem 1 of 

Theorem 1. Suppose S is an (n — k)- dimensional linear subspace of E which is contained in 
its dual S 1 - (with respect to the inner product Ofy), and is such that there are no vectors of 
weight < d — 1 in S 1 - \ S. Then there is a quantum- error- correcting code mapping k qubits to 
n qubits which can correct \{d — l)/2] errors. 

We will describe such a quantum-error-correcting code by saying it has parameters [[n, k, d]], 
and call d the minimal distance of the code. A code obtained via Theorem [5] will be called 
an additive code. Almost all quantum-error-correcting codes known at the present time are 
additive. However, we will have occasion to discussion more general codes in this paper, and 
will use the symbol ((n, K, d)) to indicate a code with minimal distance d (see |3^]) that encodes 
K states into n qubits. Of course, an [[n,k, d]] code is also an ((n, 2 k ,d)) code. 

Readers who are most interested in the codes themselves could now proceed directly to 
Section 3. 

To motivate the following discussion we begin by describing classical binary linear codes 
from a slightly unusual perspective. A linear code C is of course a linear subspace of ZJ, , where 
Z 2 = {0,1}. But Zr, can also be regarded as the group of possible errors, i.e., C is also a 
subgroup of the error group. Furthermore, this subgroup C has the following characterization 
in terms of the error group: an error e is in C precisely when translation by e takes codewords 
to codewords and thus cannot be detected. C corrects a set of errors if and only if the sum 
of any two errors can be detected, i.e. lies outside C, except that the sum may be the trivial 
error 0, which, while it cannot be detected, has no effect. 

In the quantum setting, it is possible for a nontrivial error to be undetectable and yet have 
no impact on the encoded state. This suggests that we should attempt to construct a quantum 
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code from a pair of subgroups of the quantum error group E. One subgroup (which we will call 
S') specifies the undetectable errors, while the other (called S) is the subgroup of S' consisting 
of errors that have no effect on the encoded state. S is the analogue of the zero subgroup in 
the classical coding case. 

It will turn out to be important to require that every element of S' commutes with S. This 
implies in particular that S is abelian. So we are led to consider when elements of E commute. 

The groupQ E has order 2 2n+2 and center S(_E) = {±7, ±i/}. The quotient group E = 
EfB(E) is an elementary abelian group of order 2 2n , and hence a binary vector space. Let V 
denote the vector space Z?>, and label the standard basis of C 2 " by \v), v G V. Every element 
e £ E can be written uniquely in the form 

e = i x X(a)Z(b) (2) 

where A G Z 4 , X(a) : \v) \v + a), Zip) : \v) -> (-l) b ' v \v), for a, b G V. The element X(a)Z(b) 
indicates that there are bit errors in the qubits for which a,j = 1 and phase errors in the qubits 
for which bj = 1. 

If e,e' £ E are given by (||) then ee' = ±e'e, where the sign is (_i) a ' b '+ a '' b . This induces 
the symplectic inner product given in (|l]): 

((a\b), (a \b )) = a ■ b' + a ■ b , 

where we write (a\b) for the image of X{a)Z{b) in E. Two elements in E commute if and only 
if their images in E are orthogonal with respect to this inner product. 

A subspace S of E is said to be totally isotropic if for all si, S2 G S the symplectic inner 
product (si,S2) = 0. A subgroup S of E is commutative if and only if its image S in E is 
totally isotropic. The dimension of a totally isotropic subspace is at most n. The groups 
X = {X(a) : a G V} and Z = {Zip) : b G V} are examples of subgroups of E whose images 
X, Z have dimension n. 

We define S ± to be the lift of (S*) -1 " to E; or, in other words, S ± is the centralizer of S in 
-E. We will take S' to be that is, S -1 will be group of undetectable errors. 

Since 5 is abelian, its elements can be simultaneously diagonalized. This induces a decom- 
position of C 2 ™ into orthogonal eigenspaces. In order for S to act trivially on the code, it is 

'E' stands for 'error group', but also serves as a reminder that E is essentially an extraspecial 2-group. The 
association of extraspecial 2-groups with finite orthogonal spaces, underlying all of this section, is a standard 
one in group theory (cf. [jjj], Theorem 23.10; [^9), Theorem 13.8). We have made further use of this theory in 
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necessary for the code to lie entirely in one of these eigenspaces. Since we also want S to 
preserve the code, we take the code to be one of the eigenspaces, to be denoted by Q (say). 
We call codes obtained in this way additive codes. 

To each eigenspace of S there corresponds a homomorphism % : S — ► C, under which each 
element of S is mapped to the corresponding eigenvalue. Then x is a character of S, and 
X(U) = i- 

Every element e £ E normalizes S, and so conjugation by e induces an action on characters. 
Since S 1 - commutes with S, elements of S 1 - induce the trivial action on the characters. Any 
element outside S 1 - negates the value of the character at each element of S with which it 
anticommutes. In particular, it induces a nontrivial action on the characters, and so E/S 1 - 
acts faithfully. 

It follows that the orbit of any given character must have size \E/S ± \. If S has dimension 
n — k, \E/S ± \ = 2 n ~ k . On the other hand there are 2 n ~ k characters of S such that x(z/) = i, 
since the quotient of any two such characters is a character of S. Thus E/S 1 - acts transitively. 
It follows that each eigenspace must have the same dimension, namely 2 k . 

It remains to determine the error-correcting properties of the code Q. In the classical 
setting, we can correct a set of errors when the quotient (really, difference) of any pair of the 
errors lies outside the set C\ {0}, that is, can either be detected or acts trivially. Analogously, 
we have the following lemma. 

Lemma 1. An additive quantum- error- correcting code Q with associated space S can correct 
a set of errors SCE precisely when e\ x e2 S 1 - \ S for all ei, e2 G S. 

Proof. Suppose an error e 6 E has occurred. In order to correct e we must find some 
error e\ G E such that e^~ 1 e acts trivially on Q, i.e., e± 1 e G S. In other words, we must 
determine the coset eS. The hypothesis implies that every coset of S 1 - contains at most one 
coset of S intersecting S. It therefore suffices to determine the coset eS- 1 -. Recall that E / S L 
permutes the eigenspaces of S regularly. If we measure in which eigenspace we now lie (which 
we can do because distinct eigenspaces are orthogonal) we can immediately read off eS 1 - . This 
measurement has no effect on the state, since the state lies inside one of the eigenspaces. 

On the other hand, suppose e\ and e2 are two errors such that ej -1 ^ G S 1 - \ S. Any 
correction procedure must take any state e\(y) G ei(Q) to v. Since ej~ 1 e2 G S^, e2(v) G ei(Q), 
so e2(y) is corrected to ^^(f). However, since e~[ l e2 S, there is a state v G Q such that 
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e i e 2(v) is not proportional to v, and we have failed to correct e%. 1=1 
It follows from the Lemma that if we let d be the minimal weight of S 1 - \ S, the code can 
correct the set of all errors of weight at most [(d — l)/2]. We have now completed the proof of 
Theorem [l]: Q maps k qubits into n qubits and can correct [(d — l)/2] errors. 

Recall that the eigenspaces of S are in one-to-one correspondence with characters of S 
satisfying x('iJ) = i- To determine which eigenspace contains a given state it is therefore 
enough to compute this character. Moreover, since x is a homomorphism, it suffices to compute 
the character on a basis for S. Each element of the basis thus provides one bit of information; 
the collection of these bits is the syndrome of the error. Of course, as in classical coding theory, 
identifying the most likely error given the syndrome can be a difficult problem. (There is no 
theoretical difficulty, since in principle an exhaustive search can always be used.) 

The Clifford groups. Encoding is carried out with the help of a family of groups called 
Clifford groups.^ There are both complex (denoted by L) and real (denoted by Lr) versions 
of these groups. 

The complex Clifford group L is defined to be the subgroup of the normalizer of E in U(2 n ) 
that contains entries from Q[rj], 77 = (1 + i)j\pl. The full normalizer of E in U(2 n ) has an 
infinite center consisting of the elements e 2mS I, 6 G M. Although these central elements have 
no effect quantum-mechanically, we wish to work with a finite group. The smallest coefficient 
ring we can use is Q[rj\, since 

{7! (l -l) (0 i)} = (0 77) ' 

The real Clifford group Lr is the real subgroup of L, or equivalently the subgroup of L with 
entries from Q[v2]. If we define Er to the real subgroup of E, then Lr is the normalizer of Er 
in the orthogonal group 0(2 n ). The group Er consists of the tensor products ±Wi £5> • • • ® w n , 
where each Wj is one of /, o~ x , a z , cr x a z . Er is an extraspecial 2-group with order 2 2n+1 and 
center {±/}, and Er/{±I} = E/H(E) = E. For many applications it is simpler to work with 
the real groups Er and Lr rather than E and L. 

The following are explicit generators for these groups. First, L is generated by E, all 
matrices of the form 

h ® • • • ® h ® H 2 (8) h ® • • • <8> h , (3) 

2 We follow Bolt et al. f flj, in calling these Clifford groups. The same name is used for a different family 
of groups by Chevalley mM and Jacobson j40| . 
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where I2 = (q l), #2 = 775 (1 liji an d all matrices diag^^ ■, where is any Z4-valued 
quadratic form on V. Similarly, Lr is generated by Er, @ and all matrices diag((— 1)^^)^^, 
where 4> is now any Z2-valued quadratic form on V. 
We also record some further properties of L and Lr: 

• L/{E,rjI) is isomorphic to the symplectic group Sj>2ri(2) (the group of 2n x 2n matrices 



over Z2 preserving the inner product (1) [23]). 

• L has order 8|S , p 2 n(2)|2 2n 

n 

= 2 n2+2n+3 Y[(4 j - 1) . 
3=1 

• Lr/Er is isomorphic to the orthogonal group 0^(2) [p3| , 

• L« has order 2|0 2 f n (2)|2 2n 

n-1 

= 2" 2+n+2 (2" - 1) n(4 J "l) • 

3=1 

• L acts on E as the symplectic group Sp2 n (2)', Lr acts on E as the orthogonal group 
2 +(2). 

The groups L and Lr have arisen in several different contexts, and provide a link between 
quantum codes, the Barnes- Wall lattices ||, Q, [71], the construction of orthogonal spreads 



and Kerdock sets ||l2|, the construction of spherical codes [O], j64j, [pq], and the construction 



of Grassmannian packings [63], |J13|]. They have also occurred in several purely group-theoretic 
contexts — see [12] for references. These groups are discussed further in the final paragraphs 
of the present paper. 

Encoding an additive code Q. Since Sp2 n (2) acts transitively on isotropic subspaces, and 
E acts transitively on eigenspaces for a given subspace, the Clifford group L acts transitively 
on additive codes. One such code is the trivial code corresponding to the subspace S with 
generators (0|ej), i = k + 1, . . . , n. By transitivity we can find an element A E L which takes 
the trivial code to Q. Of course A is not unique. Cleve and Gottesman have given explicit 
gate descriptions to doing this. 

Pure vs. degenerate. In the quantum coding literature there is an important distinction 
made between degenerate and nondegenerate codes. A nondegenerate code is one for which 
different elements of E produce linearly independent results when applied to elements of the 
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code. We will find it convenient to introduce a second dichotomy, between pure and impure 
codes. We will say that a code is pure if distinct elements of E produce orthogonal results. 

It is straightforward to verify that, for additive codes, 'pure' and 'nondegenerate' coincide. 
In general, however, a pure code is nondegenerate but the converse need not be true. 

For many purposes the pure/impure distinction is the correct one to use for generalizing re- 
sults from additive to nonadditive codes, and we will therefore use this terminology throughout 
the paper. 

Bases. To find an explicit basis for Q we may proceed as follows. Choose a maximal 
isotropic subspace T containing S, and consider the 1-dimensional eigenspaces of T. We obtain 
a basis for Q by selecting those eigenspaces for which the corresponding character agrees with 
the given character on S. (Equivalently, we may take all the eigenspaces lying inside Q.) The 
choice of T is of course not unique, and we have the same freedom in choosing a basis as we 
did earlier when choosing the element A of the Clifford group. 

We conclude this section by restating Theorem [l] in more detail. 

Theorem 1. Suppose S is an n — k- dimensional linear subspace of E which is contained in 
its dual S 1 - (with respect to the inner product fify), and is such that there are no vectors of 
weight < d — 1 in S 1 - \ S. Then by taking an eigenspace (for any chosen linear character) of 
S, we obtain a quantum- error- correcting code mapping k qubits to n qubits which can correct 
[(d — l)/2] errors. 

3. From binary spaces to codes over GF(4) 

As is customary (cf. [^]) we take the Galois field GF(A) to consist of the elements 
{0, l,u,u}, with to 2 = lu + 1, lo 5 = 1, and conjugation defined by x = x 2 ; the trace map 
Tr : GF(4) — » Z2 takes x to x + x. The Hamming weight of a vector u £ GF(4) n , written wt(u), 
is the number of nonzero components, and the Hamming distance between u, v! G GF{A) n is 
dist(it, v!) = wt(u — u'). The minimal Hamming distance between the members of a subset C 
of GF(A) n will be denoted by dist(C). 

To each vector v = (a\b) G E we associate the vector (ft(v) = wo + u)b G GF(4) n . It is 
immediate that the weight of v is equal to the Hamming weight of (ft(v), and the distance 
between vectors v = (a\b), v' = {a'\b') £ E is equal to dist(i^(w), <j){v')). The symplectic inner 
product of v and v' (see ([[])) is equal to Tr((f>(v) • <ft(v')), where the bar denotes conjugation in 
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GF(4), since 

Tr((f)(v) • 0(7)) = Tr((cja + cj&) • (wa' + wb')) 

= (a • a')Tr(l) + (a • b')Ti(u) + (a' • b)Tr{u) + (6 • fe')Tr(l) 
= a ■ b' + a • b . 

If S is a linear subspace of E then C = <p(S) is a subset of GF(4) n which is closed under 
addition. We shall refer to C as an additive code over GF(4), and refer to it as an (n, 2 k ) code 
if it contains 2 k vectors. If C is also closed under multiplication by w, we say it is linear. 

The trace inner product of vectors u,v £ GF(4) n will be denoted by 

n 

u*v = Ttu-v = ^^{ujVj + UjVj) . (4) 

J=l 

If C is an (n, 2 fc ) additive code, its dual is defined to be 

C 1 - = {u £ GF(A) n :u*v = for all v G C} . (5) 

Then C 1 - is an (n, 2 2n ~ k ) code. If C C C 1 - we say C is self- orthogonal, and if C = C" 1 then C 
is self-dual. 

Theorem [l] can now be reformulated. 

Theorem 2. Suppose C is an additive self- orthogonal subcode of GF(A) n , containing 2 k vec- 
tors, such that there are no vectors of weight < d — 1 in C 1 - \ C. Then any eigenspace of 
4>~ l (C) is a quantum- error- correcting code with parameters [[n,n — k,d]]. 

We say that C is pure if there are no nonzero vectors of weight < d in C^; otherwise we 
call C impure. Note that the associated quantum-error-correcting code is pure in the sense of 
Section 2 if and only if C is pure. We also say that a quantum-error-correcting code is linear 
if the associated additive code C is linear. 

When studying [[n, k, d]] codes we allow k = 0, adopting the convention that this corre- 
sponds to a self-dual (n, 2 n ) code C in which the minimal nonzero weight is d. In other words, 
an [[n, 0, d\] code is "pure" by convention. An [[n, 0, d]} code is then a quantum state such that, 
when subjected to a decoherence of [(d — l)/2] coordinates, it is possible to determine exactly 
which coordinates were decohered. Such a code might be useful for example in testing whether 
certain storage locations for qubits are decohering faster than they should. These codes are 
the subject of Section 6. 
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Most codes over GF(4) that have been studied before this have been linear and duality has 
been defined with respect to the hermitian inner product u ■ v. We shall refer to such codes as 
classical. 

Theorem 3. A linear code C is self- orthogonal (with respect to the trace inner product ^)) 
if and only if it is classically self-orthogonal with respect to the hermitian inner product. 

Proof. The condition is clearly sufficient. Suppose C is self-orthogonal. For u,v E C let 

u ■ v = a + (3ll>, a, f3 £ 7*2- Then Tr(u ■ v) = implies j3 = 0, and Tr(u • Qv) = implies a = 0, 
so u ■ v = 0. □ 

The following terminology applies generally to additive codes over GF(4). We specify an 
(n,2 k ) additive code by giving either a k x n generator matrix whose rows span the code 
additively, or by listing the generators inside diamond brackets ( ). If the code is linear a 
k/2 x n generator matrix will suffice, whose rows are a GF(4)-basis for the code. 

Let Q n denote the group of order 6 n n! generated by permutations of the n coordinates, 
multiplication of any coordinates by u>, and conjugation of any coordinates. Equivalently, Q n 
is the wreath product of 5*3 by S n generated by permutations of the coordinates and arbitrary 
permutations of the nonzero elements of GF{A) in each coordinate. Q n preserves weights and 
trace inner products. Two additive codes over GF(4) of length n are said to be equivalent if 
one can be obtained from the other by applying an element of Q n . The subgroup of Q n fixing a 
code C is its automorphism group Aut(C). The number of codes equivalent to C is then equal 
to 

an \ 

(6) 



Aut{C) ' 

We determine the automorphism group of an (n, 2 k ) additive code C by the following 
artifice. We map C to a [3n, k] binary linear code (3(C) by applying the map — > 000, 
1 — > 011, lo — > 101, L> — > 110 to each generator of C . Let Q, denote the (n, 2 2n ) code containing 
all vectors, and form Using a program such as MAGMA ||], ||], |l0[ we compute the 

automorphism groups of the binary linear code f3(C) and their intersection is Aut(C). 

Any (n, 2 k ) additive code is equivalent to one with generator matrix of the form 



" 4 










A 2 





hi 


B 3 . 
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where I r denotes an identity matrix of order r, Aj is an arbitrary matrix, Bj is a binary matrix, 
and k = 2ko + k\. An (n, 2 k ) code is called even if the weight of every codeword is even, and 
otherwise odd. 

Theorem 4. An even additive code is self-orthogonal. A self-orthogonal linear code is even. 

Proof. The first assertion holds because 

wt(u + v) = wt(u) + wt(-u) + u * v (mod 2) (7) 
for all u, v £ GF(4:) n , and the second because 

u * (lou) = wt(u) (mod 2) . (8) 

□ 

The weight distribution of an (n, 2 k ) additive code C is the sequence Aq, . . . , A n , where Aj 
is the number of vectors in C of weight j. It is easy to see that the weight distribution of any 
translate u+C, for u € C, is the same as that of C, and so the minimal distance between vectors 
of C is equal to the minimal nonzero weight in C. The polynomial W(x,y) = J2 7 j=o J ^j xn ~' , y J 
is the weight enumerator of C (cf. [j52| ). 

Theorem 5. // C is an (n,2 k ) additive code with weight enumerator W(x,y), the weight 
enumerator of the dual code C 1 - is given by 2~ k W(x + 3y, x — y). 

Proof. This result, analogous to the MacWilliams identity for linear codes, follows from the 
general theory of additive codes developed by Delsarte [pi] , since our trace inner product is a 



special case of the symmetric inner products used in [28|. □ 

4. General constructions 

In this section we describe some general methods for modifying and combining additive 
codes over GF(4). 

The direct sum of two additive codes is defined in the natural way: C®C = {uv : u € C,v S 
C'}. In this way we can form the direct sum of two quantum-error-correcting codes, combining 
[[n, k, d]] and [[n', k' , d']] codes to produce an [[n + n',k + k! , d"]] code, where d" = min{d, d'}. 
An additive code which is not a direct sum is called indecomposable. 
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Theorem 6. Suppose an [[n,k,d]} code exists, (a) If k > then an [[n + 1, k,d]] code exists. 

(b) If the code is pure andn > 2 then an [[n — 1, k+1, d— 1]] code exists, (c) Ifk > 1 orifk = 1 
and the code is pure, then an [[n, k — 1, d]} code exists, (d) If n > 2 then an [[n — 1, k, d— 1]] 
code exists, (e) If n > 2 and the associated code C contains a vector of weight 1 then an 
[[n — 1, k, d}} code exists. 

Proof. Let C and C 1 - be the associated (n,2 n ~ k ) and (n,2 n+k ) additive codes, respectively, 
with C C C ± . (a) Form the direct sum of C with c\ = {0, 1}. The resulting [[ra+1, k, d]] code is 
impure (which is why the construction fails for k = 0). (b) Puncture C 1 - (cf. |)^]) by deleting 
the first coordinate, obtaining an (n — l,2 n+fc ) code B 1 - (say) with minimal distance at least 
d — 1. The dual of B 1 - consists of the vectors u such that 0u G C, and so is contained in B^~. 

(c) There are (n,2 n ~ k+1 ) and (ra^™^ 1 ) additive codes B and B 1 - with CcBcBkC 1 . 

(d) Take B = {u : Ou or lu G C}, so that B 1 = {v : Ov or lv G C" 1 }. The words in B 1 \ B 
arise from truncation of words in C 1 - \ C. Any words in C 1 - \ C of weight less than d either 
begin with worw, and so are not in or begin with a or 1, and so (after truncation) are 
in B 1 - \ B. Words of weight d in C 1 - beginning with 1 become words of weight d — 1, so the 
minimal distance in general is reduced by 1. The proof of (e) is left to the reader. □ 

To illustrate Part (a) of the theorem, from the [[5, 1,3]] Hamming code (see Section 5) we 
obtain an impure [[6,1,3]] code. On the other hand exhaustive search (or integer programming, 
see Section 7) shows that no pure [[6, 1,3]] exists. This is the first occasion when an impure 
code exists but a pure one does not. 

A second [[6,1,3]] code, also impure not equivalent to the first, is generated by 000011, 
011110, OivLULULULU, WIljljlo, w0cju)10. Up to equivalence, there are no other [[6, 1,3]] codes. 

If we have additional information about C then there is a more powerful technique (than 
that in Theorem ^(d)) for shortening a code. 

Lemma 2. Let C be a linear self-orthogonal code over GF(4). Suppose S is a set of coordinates 
of C such that every codeword of C meets S in a vector of even weight. Then the code obtained 
from C by deleting the coordinates in S is also self-orthogonal. 

Proof. Follows from Theorem ||. □ 

Theorem 7. Suppose we have a linear [[n, k, d]] code with associated (n,2 n ~ k ) code C. Then 
there exists a linear [[n — m, k', d']] code with k! > k — m and d! > d, for any m such that there 
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exists a codeword of weight m in the dual of the binary code generated by the supports of the 
codewords of C . 



Proof. Let S be the support of such a word of weight m. Then S satisfies the conditions of 
the Lemma, and deleting these coordinates gives the desired code. □ 

For example, consider the [[85, 77, 3]] Hamming code given in the following section. The 
code C is an (85,2 ) code, and the supports of the codewords in C generate a binary code 
with weight enumerator 

x 85 + 3570x 5 V 2 + 38 80x 45 y 40 + 23800x 37 y 48 + 85x 21 y 64 . 



The Mac Williams transform of this ( ||52|| , Theorem 1, p. 127) shows that the dual binary code 
contains vectors of weights 0, 5 through 80, and 85. From Theorem |7| we may deduce the 
existence of [[9,1,3]], [[10,2,3]],... ,[[80,72,3]] codes (see the entries labeled S in the main 
table in Section 8). 

There is an analogue of Theorem |?| for additive codes, but the construction of the corre- 
sponding binary code is somewhat more complicated. 

The direct sum construction used inTheorem |6|(a) can be generalized. 

Theorem 8. Given two codes [[ni, k\, di]] and [[^2,^27^2]] with k2 < n\ we can construct an 
[\n\ + n2 — &2 ; ki, d]] code, where d > min{di, d\ + c?2 — ^2}. 

Proof. Consider the associated codes C±, with parameters (ni,2 ni ~ fcl ), (ni,2™ 1+fel ) and 
C2, C2 with parameters (712, 2 n2 ~ k2 ), (712, 2 n2+k2 ). Let p be the composition of the natural map 
from C2 to C2/C2 with any inner-product preserving map from C2/C2 to GF(A) k2 . Then 
we form a new code C = {uv : v G C^upiy) G Ci}, with C 1 - = {uv : v G C2,up(v) G Cj 1 }. 
If p(v) 7^ 0, v contributes at least d 2 to the weight of uv, but u need have weight only d\ — k 2 . 
If p{v) = 0, and uv ^ 0, wt(u) > d%. □ 

Different choices for p may produce inequivalent codes. Choosing p corresponds to choosing 
an encoding method for C2. 

For example, if the second code is the [[1,0,1]] code with generator matrix [1], the new 
code has parameters [[ni + 1, fci,di]], as in Theorem ||(a). A different [[n\ + l,fc, di]] code is 
obtained if we take the second code to be the [[2,1,1]] code with generator matrix [11]. In 
particular, the second [[6, 1,3]] code mentioned above may be obtained in this manner. 
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Theorem || can be used to produce an analogue of concatenated codes in the quantum 
setting. If Qi is an [[nm, k]] code such that the associated (nm, 2 nm+k ) code has minimal 
nonzero weight d in each m-bit block, and Q2 is an [[n,2, m, cfe]] code, then encoding each block 
of Qi using Q2 (as in Theorem ^) produces an [[nn2, k, dd,2\] concatenated code. 

A particularly interesting example is obtained by concatenating the [[5,1,3]] Hamming code 

(see Section 5) with itself. We take Q\ = Q2, and let the associated linear (5,2 4 ) code have 
TO 1 1 1 11 

generator matrix _ . Then we obtain a [[25, 1, 9]] code for which the associated 

1 U 1 U! U) 

(25, 2 24 ) and (25, 2 26 ) linear codes have the generator matrices shown in Fig. 1. Although the 
Hamming code is pure, the concatenated code is not. 



Figure 1: Generator matrices for a (25, 2 24 ) linear code (above the line) and its dual, a (25, 2 26 ) 
linear code (all rows), corresponding to a [[25, 1,9]] quantum code. 



0000 
0000 
0000 
0000 
0000 
0000 
0000 
0000 
01111 
lOlww 
0000 
OOlcDw 



0000 
0000 
0000 
0000 
0000 
0000 
0111 
101w 
0000 
0000 
OOIcj 
0000 



00000 
00000 
00000 
00000 
00111 
lOlw 
10000 
u)0000 
00000 
00000 
wOOIcj 
OOOIcj 



0000 00 
0000 1 
0011110 
10 1 uojO 
1000 00 
cDOOO 00 
0000 00 
0000 00 
0000 00 
0000 00 
luOO lcuwO 
wOOw 1 ljO 



1111 

1 UJ U! 

00 
00 
00 
00 
00 
00 
00 
00 
1 u)u) 
OcDw 1 



0000 00000 OOOlwwOOfDtjIOOwlw 



The construction of quantum codes used in [0] can be restated in the present terminology 
(and slightly generalized): 

Theorem 9. Let C% C C2 be binary linear codes. By taking C = loC\ + coC^ in Theorem 
we obtain an [[n, ki — k\,d\] code, where d = min{dist(C2 \ C\), dist(Cf L \ C^)}- 



Proof. It is easily verified that C is additive and that C C C ± = u>Ci + u>C2- 



□ 



Another construction based on binary codes due to Gottesman [35] can be generalized as 
follows. 



Theorem 10. Let S m be the classical binary simplex code of length n = 2 m — 1, dimension m 
and minimal distance 2 m_1 (Chapter 14 of 15^])- Let f be any fixed-point- free automorphism 
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of S m and let Q m be the (2 m , 2 m+2 ) additive code generated by the vectors u + ujf(u), u £ S m , 
with a appended, together with the vectors 11 . . . 1, uu...u of length 2 m . This yields a 
[[2 m , 2 m - m - 2, 3]] quantum code. 

We omit the proof. 

We can show that Q m has the following properties (again, to save space, the proofs are 
omitted). 

(i) For any choice of /, Q m has weight enumerator 

0771 , ™ . om — 2 q om — 2 om 

x 2 +4(2 m -l)x 2 y 3 - 2 + 3y 2 . 

(ii) The vectors of weight 2 m generate a subcode of dimension 2. 

(iii) Suppose <5 m is constructed using the automorphism /, and Q' m using /'. Then Q' m is 
equivalent to Q m if and only if /' is conjugate under Aut(S m ) to one of 

{/, 1 - /, 1//, 1 - 1//, 1/(1 - /), //(l - /)} . (9) 

(iv) The automorphism group of Q m has a normal subgroup H which is a semidirect product 
of the centralizer of / in Aut{S m ) with S m , the index [Aut{Q m ) : H] being the number 
of elements of @ that are conjugate to /. 

(v) Q m is linear precisely when / satisfies f 2 + / + 1 = 0. 

Before giving some examples, we remark that Aut(S m ) is isomorphic to the general linear 
group GL m {2), and conjugacy classes of GL m (2) are determined by their elementary divisors. 
So the most convenient way to specify / is by listing its elementary divisors. 

For m = 3, there is a unique choice for /, with elementary divisor x 3 + x + 1, and so there 
is a unique G3, with parameters [[8,3,3]]. Then Aut{Q%) has order 168, and is a semidirect 
product of a cyclic group C3 with the general affine group GA\(8). 

For m = 4 there are three distinct codes Q4, with parameters [[16, 10, 3]]. The corresponding 
elementary divisors for / are: 

(a) x 2 + x + 1 (twice). This produces a linear code, with |Aui(£/4)| = 17280. (In general 
the code is linear precisely when all the elementary divisors are equal to x 2 + x + 1.) 

(b) (x 2 + x + l) 2 , with \Aut(g 4 )\ = 1152. 

(c) x 4 + x + 1, with \Aut(g 4 )\ = 480. 
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For m = 5 there are two distinct G§ codes, with parameters [[32, 25, 3]]. The corresponding 
elementary divisors are 

(a) x 3 + x + 1 and x 2 + x + 1, with \Aut(G 5 )\ = 2016. 



(b) x 5 + x 2 + 1, with |^nt(^ 5 



992. 



Gottesman [37] used just a single /, which he took to be (if m is even) 



10 
10 


1111 



while if m is odd the first row is complemented. Gottesman's codes correspond to those labeled 
(c) (for m = 4) and (b) (for m = 5). 

The codes in Theorem |l^ can be extended. 

Theorem 11. For m > 2, i/iere exists an [[n, n — m — 2, 3]] code, where n is 

m/2 (m-l)/2 

^]2 2i (m even), ^ 2 2m (m odd) . 

i=0 i=l 

Sketch of proof. The corresponding (n, 2 m+2 ) additive code C (say) has weight enumerator 

x n + (2 m+2 _ 1)2 .n-2 m y 2- (m eyen) 



or 



x n + (2 



m+2 



m\^n-2 m +2 / ,,2 m -2 



2 m )x 



!J 



+ (2 m - l ).r" 2 //- (m odd) 



We take C2 and C3 to be the additive codes corresponding to the [[5, 1, 3]] and [[8, 3, 3]] codes 



already mentioned. For m > 3, let Q m be as in Theorem 10, and let Q' m be the subcode 
consisting of the weight 2 m codewords in Q m . Finally, let <j) be any isomorphism between C m _2 
and QmjQ'ra (note that both are spaces of dimension m). Define a new code C m to consist of 
all vectors V\V%, where v\ G C m _2 and <t>(v%) = V2 + Q' m . A simple counting argument verifies 
that C m has the claimed weight distribution. By applying Theorem ||] we find that has 
minimal distance 3. □ 



Theorem 11 was independently discovered by Gottesman 

The resulting codes, like those constructed in Theorem |l(], are pure and additive but 
in general are not linear. For even m we obtain the Hamming codes of Section 5 as well 
as nonlinear codes with the same parameters. For odd m we obtain [[8,3,3]], [[40,33,3]], 
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[[168,159,3]], . . . codes. A generator matrix for the (40, 2 ) additive code corresponding to a 
[[40, 33, 3]] code is shown in Fig. 2. 

Figure 2: Generator matrix for (40, 2 7 ) additive code, producing a [[40,33,3]] quantum code. 
"000000001111111111111111111111111111111 l" 

^LOUUUUUUUJU)UJUJUJUJLOLOLOLOLOLOLOLOUJU}U}U}UUijJU:UJbJ^ 

00 IOloloOIujO 1 IQujujQI 1 OuiOl OlvOlvOI 00 IOujOujO lO 

luul OcjcjOcjO OwOwcj lOl lu)lu)U)lu)l lu)lu)u;0u;00u;0u>u> 
0w0u)1u)1uj0 110 01 IuloOOloloOOO 0110 01 luaoOOwwOOO 

1 OwOwwlwOOOwwwwl 1 1 IOOOOOOOOujujojujI 1 1 100000 
w0u;lu)lu)0 00 1 1110000111 1 ujujujojOOOOujujujujOOOO 

The u u\u + v" construction for binary codes ([p2|, page 76) has an analogue for quantum 
codes. 

Theorem 12. Suppose there is a pure [[n, fcijdj.]] code with associated (n, 2 n ~ kl ) additive code 
C\, and a pure [[n, ^2^2]] code with associated code C 2 , such that C\ C C 2 . Then there exists 
a pure [[2n, k\ — k 2 , d}] code, where d = min{2<ii, 5}, 5 = dist(C2). 

Proof. Take C to be the (2n,2 2n ~ kl+k2 ) additive code consisting of the vectors u\u + v, 
u G C2, v G Ci, where the bar denotes concatenation. Then C 1 - = {u\u + v : u G Cj 1 , w G C2} 
has minimal distance min{2c?i, 5}, by Theorem 33 of [p^j , Chapter 1. □ 

For example, by combining the [[14, 8, 3]] and [[14, 0, 6]] codes shown in Table II of the next 
section we obtain a [[28, 8, 6]] code. 

Concerning the structure of additive but nonlinear codes, it is pointless to simply add 
one generator to a linear code. For if D is an (n,2 n+k ) linear code, and D' = (D,v) is an 
(n, 2 n+k+1 ) additive code with minimal distance d, then it is easy to show that the linear code 
D" = (D,v,ujv) also has minimal distance d. 

We end this section by listing some trivial codes. An [[n, k, 1]] code exists for all < k < n, 
n > 1. An [[n, k,2]] code exists provided < k < n — 2, ifn>2is even, or provided 
< k < n — 3ifn>3is odd. 

5. Cyclic and related codes 

An (n,2 k ) additive code C is constacyclic if there is a constant k (which in our case will 
be 1, u or O) such that (uq, u\, . . . , u n _i) G C implies uq, ui, . . . , Un-2) G C. If At = 1 
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the code is cyclic. Besides these standard terms from the classical theory, we also need a new 
concept: if (ito, u\, . . . , ix n -i) G C implies (u n -i, uq, u\, . . . , u n -2) G C, the code will be called 
conjucyclic. 

We begin with linear codes. If vectors are represented by polynomials in the natural way, 
a linear constacyclic code is represented by an ideal in the ring of polynomials modulo x n — k 
( |Q| , [[I?]] ) . The latter is a principal ideal ring, so the code consists simply of all multiples of 
a single generator polynomial g(x), which must divide x n — k. We assume n is odd. 

Theorem 13. A linear cyclic or constacyclic code with generator polynomial g{x) is self- 
orthogonal if and only if 

g(x)g J< (x) = (mod x n — k) , 

where if g(x) = YljZo 9jX J 

n-1 

g ] (x) = ng + ^2 9n-jx J . (10) 



We omit the elementary proof (cf. [|T5[). Note that 

g^ (x) = g(x~ l ) (mod x n — k) . 
The f operation induces an involution on factors of x n — k, so we can write 

x n -K = Up^U^^H^)) , (ii) 

« 3 

where the pi, qj and gj are all distinct and p\ = p\. Then a divisor g(x) of x n — k generates a 
self-orthogonal linear constacyclic code if and only if g(x) is divisible by each of the p^s and 
by at least one from each qj, qj pair. 

Example. The classical Hamming code H over GF{4) has length n = (4 m — l)/3, contains 



4 n ~ m codewords and has minimal distance 3, for m > 1 [^], [5C]. The dual code C = H is a 
self-orthogonal linear code, and the corresponding quantum code has parameters [[n, n— 2m, 3]], 
where n = (4 m — l)/3. C and H are cyclic if m is even, constacyclic if m is odd. For example 
when m = 2 we can take H to have generator polynomial g(x) = x 2 + cox + 1, a divisor of 
x 5 — 1, and when m = 3 we take g(x) = x 3 + x 2 + x + u, a divisor of x 21 — to. These codes meet 



the sphere-packing bound (14) (see Section 7) with equality. The smallest Hamming code, a 



[[5,1,3]] code, was independently discovered in the present context by || and [48]. See also 
0- 
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Hamming codes correct single errors. In the classical theory the generalizations of Hamming 
codes that correct multiple errors are known as BCH codes |p2| . A similar generalization yields 
multiple-error correcting quantum codes. 

Rather than giving a complete analysis of these codes, which involves a number of messy 
details, we simply outline the construction and give some examples. These quantum BCH 
codes may be cyclic or const acyclic. 

In the cyclic case we let £ be a primitive n-th root of unity in some extension field of GF{A), 



and write each factor qj in as qj(x) = IlseS ( x ~~ £ S )j the zero se ^ &j being a cyclotomic 



coset modulo n under multiplication by 4 (see J5^], Chap. 7). The zero set associated with qj 
is then —2Sj. We choose a minimal subset of the qj's subject to the conditions that (a) there is 
an arithmetic progression of length d — 1 in the union of its zero sets, for which the step size is 
relatively prime to n, and (b) if qj is chosen, qj is not. Let B be the cyclic code whose generator 
polynomial is the product of the qfs. Then (a) guarantees that B has minimal distance at 
least d and (b) guarantees that B D B 1 - . In this way we obtain a quantum error-correcting 
code with parameters [[n, k, d]}, where k = n — 2degg. 

A similar construction works in the constacyclic case, only now we choose £ to be a primitive 
(3n)-th root of unity. 

In the special case when n = (4 m — l)/3, most of the qj have degree m, and we obtain a 
sequence of cyclic or constacyclic codes which provided m is at least 4, begins 

[[n, n — 2m, 3]], [[n, n — 4m, 4]], [[n, n — 6m, 5]], [[n, n — 8m, 7]], . . . . 

For example when m = 4 we obtain [[85, 77, 3]], [[85, 69, 4]], [[85, 61, 5]] and [[85, 53, 7]] codes. 

We now discuss additive (but not necessarily linear) codes. Note that an additive consta- 
cyclic code (with k = u or Co) is necessarily linear. 

Theorem 14. (a) Any (n,2 k ) additive cyclic code C has two generators, and can be repre- 
sented as (ujp(x) + q(x),r(x)) , where p(x), q(x), r(x) are binary polynomials, p(x) and r(x) 
divide x n — 1 (mod 2), r(x) divides q{x){x n — l)/p(x) (mod 2), and k = 2n — degp — degr. 
(b) If {ojp 1 '(x) + q'(x),r'(x)) is another such representation, then p'(x) = p(x), r'(x) = r(x) 
and q'(x) = q(x) (mod r(x)). (c) C is self- orthogonal if and only if 

p(x)r(x n ~ v ) = p(x n ^ 1 )r(x) = (mod x n - 1) , 
p{x)q{x n ^) = pix^qtx) (mod x n - 1) . 
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Proof, (a) Consider the map Tr : C —> l<2[x]/(x n — 1) obtained by taking traces 
componentwise. The kernel of this map is a binary cyclic code, so can be represented uniquely 
as (r(x)), where r{x) divides x n — 1. The image of the map is similarly a binary cyclic code 
(p(x)). The original code is generated by r(x) and some inverse image of p(x), say ujp{x) + q{x). 
Finally, if r(x) did not divide q(x)(x n — l)/p(x), then ((x n — l)/p(x)){ujp{x) + q(x)) would be 
a binary vector of C not in (r(x)), a contradiction. We omit the proof of (b). (c) One readily 
verifies that the inner product of the vectors corresponding to uif(x) + g(x) and uh(x) + i(x) 
is given by the constant coefficient of 

f{x)i{x n - 1 ) + g{x)h{x n - 1 ) (mod x n - 1) . 

But then the inner product of the vectors corresponding to ujf(x) + g{x) and x m {ojh(x) +i{x)) 
is given by the coefficient of x m in f(x)i(x n ~ l ) + g{x)h{x n ~ l ). The result follows immediately. 
□ 

We remark without giving a proof that if C is self-orthogonal we may assume that q(x) 
satisfies 

andr(x) divides q(x)(x n — l)/p(x), where tt(x) = 7r(x™ _1 ) (mod x n — l),ir(x) = ( mod p(x)), 
and dega < degr + degp — n. This makes it possible to search through all self-orthogonal 
additive cyclic codes of a given dimension: r(x) ranges over all divisors of x n — 1, p{x) ranges 
over all divisors of (x n — l)/gcd{r(x n ~ 1 ),x n — 1} of the appropriate degree, and finally all 
choices for ir(x) and a(x) must be considered. 

Table I lists some additive cyclic codes that were found in this way. 

Table I: Cyclic codes. 

Parameters Generators for additive code 

[[15,0,6]] W11010100101011 

[[21,0,8]] wwlwOOllllOlOllOHOOO, 101110010111001011100 

[[23, 0, 8]] w0 1 1 1 1 1000000001111010 

[[23, 12, 4]] UjujujujujX IcjIIwIcjIOIIOOOOOO 

[[25, 0, 8]] 111 IOljO 101 1 1000000000000 
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Theorem 15. Let C be an (n,2 k ) additive conjucyclic code, and form the binary code 

C = {Tr(um)|Tr(um) : u G C} , 

when the trace is applied componentwise and the bar denotes concatenation. Then C is a 
binary cyclic code of length 2n, which is self- orthogonal if and only if C is self- orthogonal. 

We omit the proof. Note that C' determines C, since 

ujTi(oju) + (DTr(um) = u . 



Theorem |15| makes it possible to search for codes of this type. So far no record codes have 
been found. 

We now return to linear codes. A quasicyclic code is a code of length n = ab on which 
the group acts as a cycles of length b. T. A. Gulliver of Carleton University (Canada) and the 
University of Canterbury (New Zealand) has extensively studied quasicyclic codes over small 



fields [38]. The last five examples in Table II were found by him. Double parentheses indicate 



the permutation to be applied. 

Table II: Linear quasicyclic codes. 

Parameters Generator 

[[14,0,6]] ((1000000)) ((wlwwOOw)) 

[[14,8,3]] ((1011100)) ((XuuulQu)) 

[[15,5,4]] ((10000)) ((1LD00)) ((llwwO)) 

[[18,6,5]] ((110000)) ((lOlcDOO)) ((llwlwO)) 

[[20,10,4]] ((10000)) ((1O100)) ((Ullw)) ((llwww)) 

[[25,15,4]] ((10000)) ((lwlwO)) (0101w)) ((lwwwl)) ((10ww0)) 

[[28,14,5]] ((cjcjcjIOOO)) ((wOlDIOOO)) ((lwwlwwO)) ((loujuuluOO)) 

[[30,20,4]] ((11100)) ((10w00)) ((llwwO)) ((lwlww)) ((10wl0)) ((lwlOO)) 

[[40,30,4]] ((OOlww)) ((Ollwl)) ((0010(D)) ((OOlwl)) (00101) ((lt^lww)) ((llltDw)) ((01a; 1(D)) 

6. Self-dual codes 

In this section we study [[n, 0, d]] quantum-error-correcting codes and their associated 
(n, 2 n ) self-dual codes C. These codes are of interest in their own right — for instance, the 
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unique [[2,0,2]] code corresponds to the quantum state ^(1^1) — 1 10) ) , that is, an EPR pair. 
They are also important for constructing [[n, k, d]] codes with k > 0, as we will see in Section 8. 
We begin with some properties of weight enumerators of self-dual codes. 

Theorem 16. (a) The weight enumerator of a self-dual code is fixed under the transformation 

replace Q by \ ( \ _\ ) Q , (13) 

and is therefore a polynomial in x + y and x 2 + 3y 2 . (b) The minimal distance of a self-dual 
code of length n is < [n/2] + 1. 



Proof, (a) (|l3| ) follows from Theorem ||, and the proof of the second assertion is parallel to 
that of Theorem 13 of |5lj] . (b) Parallel to the proof of Corollary 3 of J53| . □ 
(The result in (b) has since been improved — see Section 9.) 

Theorem 17. (a) The weight enumerator of an even self-dual code is a polynomial in x 2 + 2>y 2 
and y 2 {x 2 — y 2 ) 2 . (b) The minimal distance of an even self-dual code of length n is < 2[n/6] + 2. 



Proof, (a) This is an immediate consequence of Theorem 13 of |5l[] . (b) From Corollary 15 



of [51|. □ 



In view of the importance of doubly-even self-dual codes in binary coding theory, we also 
note the following result. 

Theorem 18. // there is an integer constant c > 1 such that the weight of every vector in a 
self-dual code is divisible by c, then c = 2. 



Proof. The proof of the Gleason-Prange theorem for classical self-dual codes as given in |)6| 
applies unchanged. □ 

It is possible to give a complete enumeration of all self-dual codes of modest length, following 
the methods of 0] and (21. 



Theorem 19. (a) The total number of self- dual codes of length n is T^[^ l =1 (2 J + 1 



0>) Eui 



n™=i(2 j + i) 



\Aut(C)\ 6 n n\ 
where the sum is over all inequivalent self-dual codes C of length n. 
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Proof, (a) Parallel to that of Theorem 19 of (b) From (a) and (|). □ 

Let d n be the (n, 2 n_1 ) code spanned by all even-weight binary vectors of length re, n > 2, 
and let d^ = (d n , LOU) . . . LO) . 

Theorem 20. Suppose C is a self-orthogonal additive code, in which no coordinate is identi- 
cally zero, and which is generated by words of weight 2. Then C is equivalent to a direct sum 
c^2 © ... © c^2 ffi d{ © dj © dk © . . . , i, j , k > 2. 



Proof. Analogous to that of Theorem 4 of [24j|. □ 



With the help of Theorems [T^ and [H] we find that the numbers t n (respectively i n ) of 
inequivalent (respectively inequivalent indecomposable) self-dual codes of length n for re < 5 
are 

n 1 2 3 4 5 
tn 1 2 3 6 11 
i n 1 1 1 2 4 

This enumeration could be extended to larger values of n without too much difficulty. 

The indecomposable codes mentioned in the above table are the trivial code c\, the codes 
d£ for n > 2, the length 4 code (1100, 0011, ulololo, OIlou), the length 5 codes 

(11000, 00110, 00101, Oluuu, wwOOl) 

and 

(11000, 00110, 10101, wwOOw, OOujujuj) , 

and a (5, 2 5 ) <i = 3 code obtained from the hexacode (see Section 8) using Theorem ||. 

We have also investigated the highest achievable minimal distance of any self-dual code 
of length n, or equivalently of any [[re, 0, d]] quantum-error-correcting code. The results are 
shown in the k = column of the main table (Section 8). Of course in view of Theorem ^(c) 
this also gives bounds on the minimal distance of any pure [[n, k, d]] code. 

We see from that table that the bound in Theorem [17] for even self-dual codes is met with 
equality at lengths 2,4,..., 22, 28 and 30. In all but one of those cases the code can be taken to 
be a classical self-dual linear code over GF(A). The exception is at length 12, where although 
no classical self-dual codes exists with minimal distance 6 [p4|], there is an additive code. This 
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is the (12, 2 ) d = 6 additive code having generator matrix 



000000111111 
00 Ololulolololo 
111111000000 
ujujujujujuj 00 
OOOIwcjOOOIcjlj 
OOOwcjIOOOcjljI 
IcjwOOOIljcjOOO 
w1o>0 0cj1(I>000 
OOOIlDwwwIOOO 
OOO^IlDIwwOOO 
IwwOOOOOOwwI 
a)lu;0000001(I>cj 

which we will call the dodecacode. This code is equivalent to the cyclic code with generator 
a-10100100101. It has weight distribution A = 1, A 6 = 396, A 8 = 1485, A w = 1980, 
A\2 = 234, and its automorphism group has order 648 and acts transitively on the coordinates. 

There is an interesting open question concerning length 24. There exists a (24, 2 24 ) d = 8 
classical code over GF{2), the Golay code, and at least two (24, 3 12 ) d = 9 classical codes over 
GF(3), all meeting the analogous bounds to Theorem [l7|(b) | |52| |. It is known |4^] that there is 
no (24, 4 12 ) d = 10 classical code over GF(4), but the possibility of a (24, 2 24 ) d = 10 additive 
self-dual code remains open. Linear programming shows that if such a code exists then it must 
be even. However, all our attempts so far to construct this code have failed, so it may not 
exist. 

7. Linear programming and other bounds 



Gottesman [35| showed that any nondegenerate [[n, k, 2t + 1]] code must satisfy the sphere- 
packing bound 

* / \ 

(14) 



Knill and Laflamme [45] have shown that any (pure or impure) code must satisfy the following 
version of the Singleton bound (cf . (5^] ) : 



n > 4e + k, 



(15) 



where e = [(d — l)/2j is the number of errors correctable by the code. In this section we first 
establish a linear programming bound which applies to all [[n, k,d]] codes, and then give a 
slightly stronger version of the Singleton bound for pure codes. 
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Suppose an [[n, k,d]] code exists, let C be the corresponding (n,2"~ fc ) code over GF(4) 
and let C -1 , an (n, 2 n+k ) code, be its dual (see Theorem §). Let Aq, . . . , A n and A' , . . . ,A' n be 
the weight distributions of C and C -1- respectively. 

In view of Theorem p|(e), we may assume that A\ = 0. (Only minor modifications to 



Theorem 21 are required if this assumption is not made.) 

The Krawtchouk polynomials appropriate for studying a code of length n over GF{A) will 
be denoted by 



x\ I n — x 



for j = 0, . . . , n (see Chapter 6 of 



Theorem 21. // an [[n,k,d\] quantum- error- correcting code exists such that the associated 
(n,2 n ~ k ) code C contains no vectors of weight 1, then there is a solution to the following set 
of linear equations and inequalities: 

A = l,Ai = 0, Aj > (2 < j < n) , (16) 

A + A 1 + --- + A n = 2 n ~ k , (17) 

A 'j = E P ^ (0<j<n) , (18) 

Z r=0 

Aj = A'j (0 < j < d- 1), Aj < A'j (d<j<n), (19) 

^A 2j = 2 n - k - 1 or 2 n ~ k , (20) 



j>o 

1 



2 



n—k- 



T ^(2r, n)A 2r > A) (0 < j < n) . (21) 



r=0 



(If the second possibility obtains in (2C), (21) just says that 2 A'j > A'j and can be omitted.) 

Proof. (15) is a consequence of Theorem ||, and (19) follows from the facts that C C C 1 - 
and any vectors in C 1 - of weights between 1 and d — 1 inclusive must also be in C. From (|?|), 
the even weight vectors in C form an additive subcode C, which is either half or all of C; (p0|) 
then follows. If C is half of C, then C C C C C 1 - C (C")~S which y ields ©• The other 



constraints are clear. □ 
A more compact statement of the linear programming bound may be obtained by rephrasing 



Theorem 21 in terms of weight enumerators. 
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W(1,0) 


= ^(1,0) = 1 


W ± (x,y) 


= 2^( X + 3y 


S{x,y) 


= 2^( X + 3y 


W ± (l,y)-W(l,y) 


= 0(y d ), 



Theorem 22. If an [[n, k, d]] quantum- error- correcting code exists then there are homogeneous 
polynomials W(x, y), W (x, y) and S(x, y) of degree n such that the following conditions hold: 

(22) 
(23) 

(24) 
(25) 

and 

W(x,y),W ± (x,y) -W(x,y),S(x,y) >0 , (26) 
where P(x,y) > indicates that the coefficients of P(x,y) are nonnegative. 

Proof. Take W(x,y) to be the weight enumerator of C and W /_L (x,y) to be the weight 
enumerator of C^. S(x, y) is the shadow enumerator (by analogy with [^]) and is nonnegative 
by Eq. ©. □ 



We have implemented Theorems 21 and 22 on the computer in two different ways. 



(i) We attempt to minimize A\ + • • • + A^-i subject to (|i"6|)-(^l|) using an optimization 



program such as CPLEX |27| or CONOPT |£§. The AMPL language |§] makes it easy to 
formulate such problems and to switch from one package to another. 

If all goes well, the program either finds a solution (which may lead to additional discoveries 
about the code, such as that there must exist a vector of a particular weight), or else reports 
that no feasible solution exists, in which case we can conclude that no [[n, k, d\] code exists. 

Unfortunately, for values of n around 30, the coefficients may grow too large for the prob- 
lems to be handled using double precision arithmetic, and the results cannot be trusted.^] 

(ii) Alternatively, using a symbolic manipulation program such as MAPLE [jn|, we may 
ask directly if there is a feasible solution to (|l|)-(|l|) or to (||)-(||) (the latter being easier 
to implement). Since the calculations are performed in exact arithmetic, the answers are 
(presumably) completely reliable. On the other hand the calculations are much slower than 
when floating point arithmetic is used. 

Most of the upper bounds in the main table were independently calculated using both 
methods. 



3 It is hoped that the multiple precision linear programming package being developed by David Applegate of 
Rice University will soon remove this difficulty. 
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When investigating the possible existence of a pure [[n, k, d]] code, we may set A 2 through 
Ad-i equal to 0. In all cases within the range of table III below, this had no effect; that is, the 
LP bound for pure codes was the same as that for impure codes. We handle ([H]) by running 
the problem twice, once for each choice of the right-hand side. 



For example, using Theorem 21 we find that there are no [[n, 1, 5]] codes of length n < 10 
for which C has A\ = 0. From Theorem ^ we conclude that no [[n, 1, 5]] code of any type exists 
with n < 10. On the other hand an [[11, 1, 5]] code does exist — see the following section. 



Additional constraints can be included in Theorem [21] to reflect special knowledge about 
particular codes, or to attempt to narrow the range of a particular Ai. Many variations are 
the basic argument are possible, as illustrated in the following examples. 

(i) No [[13,0,6]] code exists. Let C be a (13, 2 13 ) additive code with d > 5, and let C be 
its even subcode. The linear constraints in Theorem [H] enable us to express all the unknowns 
in terms of A§ and Aq. The condition that the weight distribution of (C) 1 - be integral implies 
certain congruence conditions on A§ and Aq, from which it is possible to eliminate Aq. The 
resulting congruence implies A$ = 1 (mod 2). In particular A$ 7^ 0, and so d = 5. 

(ii) No [[18, 12,3]] code exists. Consider the (18, 2 6 ) additive code C. Linear programming 
shows that C must contain a vector of weight 12, which without loss of generality we may take 
to be uq = 6 1 12 . We define the refined weight enumerator of C with respect to uo to be 

„ / \ v - ^ 6— a(u) a(u) 12— b(u)— c(u) b(u) c(u) 

Rc[x ,xi,y ,yi,y2) = }^ x o x i Vi % > 

where a(u) is the weight of u in the first 6 coordinates, and b(u) (resp. c(n)) is the number of 
l's (resp. u's or <D's) in u in the last 12 coordinates. The conditions on C imply that c(u) = 
(mod 2), 

(a(u + u ),b(u + u ),c(u + u )) = (a(u), 12 - b(u) - c(u),c(u)) , 

and 

Rc± = Jdi^^ + 3xi ' x ° ~ Xl,yo + m + 2y2 ' y ° + yi ~ 2 y^y^ - s/i) • 

By applying linear programming, we find that the weight distribution of C must be either 
= 1) A\<2 = 9, A u = 54 or A = 1, A 12 = 1, A 13 = 24, A u = 30, A 15 = 8. In either case, 
adding these constraints to the refined weight enumerator produces a linear program with no 
feasible solution. 

(iii) Similar arguments eliminate the parameters [[7,0,4]], [[15,4,5]], [[15,7,4]], [[16,8,4]], 
[[19,3,3]], [[22,14,4]] and [[25,0,10]]. 
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In the remainder of this section we briefly discuss another version of the Singleton bound 
(cf. (H)): 



Theorem 23. If a pure [[n, k, d]] code exists then k < n — 2d + 2. 

Proof. The associated code C 1 - is then an additive (n, 2 n+k ) code with minimal distance d. 



From Theorem 15 of [28], we have 



which implies k < n — 2d + 2. □ 

If d is odd this coincides with the Knill and Laflamme bound ( |i"5| ) , but is slightly stronger 
if d is even. 

We have determined all codes that meet this bound — these are analogues of the classical 
MDS codes (cf. Chapter 11 of |52||), Since the results are somewhat disappointing we simply 
state the answer and omit the rather lengthy proof. 

Theorem 24. A pure [[n,n — 2d + 2,d]] code has parameters [[n,n, 1]] (n > 1), [[n,n — 2,2]] 
(n even > 2), [[5, 1,3]] or [[6,0,4]]. Up to equivalence there is a unique code in each case. 

Even allowing k = n — 2d + 1 does not appear to lead to any new codes. Further analysis 
shows that any pure [[n, n — 2d+ 1, d]] code has parameters [[n, n — 1, 1]] (n > 1), [[n, n — 3, 2]] 
(n>3), [[5,0,3]] or [[8,3,3]]. 

8. A table of quantum-error-correcting codes 

Table III, obtained by combining the best upper and lower bounds given in the previous 
sections, shows our present state of knowledge about the highest minimal distance d in any 
[[n, k, d]] code of length n < 30. 



Table III about here 

Notes on Table III 

When the exact value of d is not known, the lower and upper bounds are separated by a 
dash. 

All unmarked upper bounds in the table come from the linear programming bound of 
Theorem |2l|. (A few of these bounds can also be obtained from Eq. ( |i~4| ) or from Theorem [l6|.) 
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Unmarked lower bounds are from Theorem ^. Note in particular that, except in the k = 
column, once a particular value of d has been achieved, the same value holds for all lower 
entries in the same column using Theorem ^(a). 

a. A code meeting this upper bound must be impure (this follows from integer programming 
by an argument similar to that used in Section 7 to show that no [[13, 0, 6]] code exists). 

(3. A special upper bound given in Section 7. These bounds do not apply to nonadditive 
codes, for which the upper bound must be increased by 1. 

7. This is the unique other entry in the table (besides those marked '/?') where the known 
upper bound for nonadditive codes is different from the bound for additive codes: if we 
omit (pl|) (which says that the code is either odd or even) from the linear program, the 



bound increases by 1. In all other entries in the table, condition (21) is superfluous. 
However, we will be surprised if a ((19, 2 8 , 5)) nonadditive code exists. 

Most of the following lower bounds are specified by giving the associated (n, 2 n ~ k ) additive 
code. 

a. The hexacode, a (6, 2 6 ) d = 4 classical code that can be taken to be the GF(A) span of 
(001111, 0101ww,1001ww) (see Chapter 3 of ||). Aut(h 6 ) = 3.5 6 , of order 2160. 



b. A classical self-dual code over GF{£) — see |5T|], j24|. 

c. A cyclic code, see Table I. 

d. A [[25, 1, 9]] code obtained by concatenating the [[5, 1, 3]] Hamming code with itself (Fig. 1 
of Section 4). 

e. The dodecacode defined in Section 6. 

f. An [[8, 3, 3]] code, discovered independently in []l6|, and [68]. The (8, 2 5 ) additive code 
may be generated by vectors ((01ww(Dlo)))0, 11111111, ujujujujujujujuj (where the double 
parentheses mean that all cyclic shifts of the enclosed string are to be used). Exhaustive 



search shows that this code is unique. Another version is obtained from Theorem 10. 
The automorphism group has order 168, and is the semidirect product of a cyclic group 
of order 3 and the general affine group {x — ► ax + b : a, b, x £ GF(8), a^0}. 

g. A quasicyclic code found by T. A. Gulliver — see Table II of Section 5. 
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h. A Hamming code, see Section 5. 



i. Use the (12, 2 8 ) and (14,2 s ) linear codes with generator matrices 

ooooooin 1 1 r 

00111 lOOllww 
1 1 uj uj 1 uj 1 uj 
IOOIcjwOIcjOu; 1 

and 

" 00000 011 1 1 11 1 1 
0011 1 1 000 11 1 1 

0101u;a)01u;a)01a;a) 
lOOlwwOlwwlOwo) 

respectively. Their automorphism groups have orders 720 and 8064, and both act transi- 
tively on the coordinates. The first of these can be obtained from the u\u+v construction 
(c.f. Theorem 12) applied to the unique [[6,4,2]] and [[6,0,4]] codes. 



j. A [[17,9,4]] code, for which the corresponding (17, 2 8 ) d = 12 code C is a well-known 



linear code, a two- weight code of class TF3 [14]. The columns of the generator matrix of 
C represent the 17 points of an ovoid in PG(3,4). Both C and C 1 - are cyclic, a generator 
for C 1 - being IujIujIO 12 . The weight distribution of C is A = 1, A 12 = 204, A 16 = 51, 
and its automorphism group has order 48960. 

s. By shortening one of the following codes using Theorem [7] or its additive analogue: the 
[[21,15,3]] or [[85,77,3]] Hamming codes (see Section 5), the [[32,25,3]] Gottesman code 
(Theorem [XoT) , the [[40, 30, 4]] code given in Table II or [[40, 33, 3]] code shown in Fig. 2. 



u. From the u\u + v construction (see Theorem 12). 



v. The following (17, 2 6 ) code with trivial automorphism group found by random search: 



OOIOujujujujI IujujOOI lu 
0u;10u;0u)u)u)l IujujujI 1 
0100 IujIujQQujOujIujOuj 

UJ UJ UJ UJ 1 U) 1 UJUJijJ 1 UJ UJ 1 

1 OujujO IuujujIujujOujI 
uj IujujujOujOujI 1 \ ujuj 



Comparison of the table with the existing tables [11] of classical codes over GF(4) reveals 
a number of entries where it may be possible to improve the lower bound by the use of linear 
codes. For example, classical linear [30, 18,8] codes over GF(4) certainly exist. If such a code 
can be found which contains its dual, we would obtain a [[30, 6, 8]] quantum code. 
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Table III: Highest achievable minimal distance d in any [[n, k, d]] quantum-error-correcting 
code. The symbols are explained in the text. 
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10 
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Table III cont. 
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Table III cont. 
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9. Subsequent developments 

In the year and a half since the manuscripts of juj] and the present paper were first circu- 
lated there have been a number of further developments. 

(i) While we showed in Section 2 that the Clifford group L suffices to encode additive 
codes, we did not give explicit recipes for doing so. Such recipes can now be found in Cleve 
and Gottesman 

(ii) The Cleve and Gottesman technique applies only to real (not complex) codes. However, 
it can be shown [|57j that any additive code is equivalent to a real additive code (and any linear 
code is equivalent to a real linear code), so this is not a severe restriction. 

(iii) DiVincenzo and Shor 130(1 have shown how to correct errors in additive codes even when 



using imperfect computational gates. The techniques of Shor [61] for performing computations 
on encoded qubits using imperfect gates have been extended to general additive codes by 



Gottesman [36]. 



However, the most efficient methods currently known for fault-tolerant computation 0, 
f42]| , [p6j , |ffcH use only Calderbank-Shor-Steane codes (cf. Theorem 9). 

(iv) It turns out that the proofs of the lower bounds on the capacity of quantum channels 
given in Bennett et al. || and DiVincenzo, Shor and Smolin |3l]] can be restated in terms 
of additive codes. In particular, this implies that these bounds can be attained using additive 
codes. 

(v) Cleve [^0| has found a way to apply asymptotic upper bounds for classical binary codes 
to additive codes. 

(vi) Steane |6^] has extended Gottesman's |35| construction (compare Theorem ^) to ob- 
tain quantum analogues of Reed-Muller codes. The smallest of these new codes has parameters 
[[32,10,6]]. 

(vii) The upper bounds in the column headed 'fc = 0' in Table III (with the exception of 
the entries marked '/?') have an obvious pattern with period 6. Further investigation of this 



pattern has led to an n/3 bound for quantum codes (cf. Theorem 17) [57] and an analogous 
n/6 bound for classical singly-even binary self-dual codes |]55| . 

(viii) The main construction in this paper (described in Section 2) can be generalized to 
primes greater than 2. Some preliminary work along these lines has been done in [Q], |43j] , p4| . 
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(ix) There are analogues of parts (a)-(c) of Theorem ^ for nonadditive codes. Parts (a) 
and (c) are trivial, while (b) now asserts that if a pure ((n, K, d)) codes exists with n > 2 then 
an ((n - l,2K,d- 1)) code exists §§). 

(x) How much of a restriction is it to use only additive quantum-error-correcting codes? We 
conjecture: Not much! So far essentially only one good nonadditive code has been found. This 
is the ((5,6,2)) code described in p9[]. The best comparable additive code is a ((5,4,2)) code. 
The ((5,6,2)) code can be used to construct a family of nonadditive codes with parameters 
((2m + l,3.2 2m ~ 3 ,2)) for all m > 2 @. The ((5,6,2)) code is optimal in that there exists 
no ((5,7,2)) code. It is not known if this is true for other codes in the family. The next 
candidate for a good nonadditive code is at length 7, where we have unsuccessfully tried to 
find a ((7,1,4)) code. 

(xi) Most of the upper bounds in this paper have only been proved to hold for additive 
codes. It turns out however that our strongest technique, the linear programming bound of 
Theorem ^2[ applies even to nonadditive codes with the appropriate definitions of W, W 1 - (see 
f62|| ) and S (see [57]). The sole change needed in the statement of Theorem 22 is that 2 k must 
be replaced by K. 

As a consequence, all but ten of the upper bounds in Table III (those marked '/?' or '7') 
apply equally to nonadditive codes. 

(xii) The purity conjecture. As we have already remarked, in the range of Table III the 
linear programming bound for pure codes is no stronger than that for impure codes. Moreover, 
for several entries in the table a code meeting the linear programming bound must be pure. 
This suggests the following conjecture. 

Conjecture. Let K be the largest number (not necessarily an integer) greater than 1 such 



that there exist polynomials W, W , S as in the nonadditive version of Theorem 22. Then 
for any such solution, 

W(l,y) = l + 0(y d ) , 

or in other words the weight enumerator is pure. 

This conjecture, together with some sort of monotonicity result about solutions to Theo- 
rem would imply the equivalence of the pure and impure linear programming bounds for 
general (additive or nonadditive) codes. 

We have verified the conjecture for all n < 50. 



36 



(xiii) Referring to the above conjecture, cases in which the extremal K are powers of 2 are 
of particular interest. In the range n < 45 these are listed in the following table. 

Table IV: Putative extremal quantum-error-correcting codes ((n, K, d)) in which K is a power 
of 2. 



(a) K = 2: 




((5,2,3)) 


(exists: Hamming code) 


((11,2,5)) 


(exists from dodecacode) 


((17,2,7)) 


(exists) 


((23,2,9)) 


(?) 


((29,2,11)) 


(exists: quadratic residue code) 


((35,2,13)) 


(?) 


((41,2,15)) 


(?) 



(b) Two infinite families: 

((2m,2 2m " 2 ,2)),m > 1 (exist) 
((n,2 n " 2m ,3)),n = (4 m - l)/3,m > 2 (exist: Hamming codes) 



(c) Some apparently sporadic possibilities: 


((18,4096,3)) 


(?, must be nonadditive 


((16,256,4)) 


(?, must be nonadditive 


((17,512,4)) 


(exists) 


((22, 2 14 , 4)) 


(?, must be nonadditive 


((27, 2 15 , 5)) 


(?) 


((28, 2 14 , 6)) 


(?) 


((40,64, 13)) 


(?) 



There are also some candidates for which K is not a power of 2. The first of these is 
((5, 6, 2)), and as mentioned above we were able to find such a code. There is an infinite family 



of other candidates with d = 2, none of which can exist [56]. The remaining possibilities for 
n < 45 are: 

((10,24,3)) 

((13,40,4)) 

((21,7168,4)) 

((24,49152,4)) 

((22,384,6)) 

((22,56,7)) 

((24,24,8)) 

((39,24,13)) 

It would be very interesting to have an elegant combinatorial construction for any of these 
codes. 



(xiv) In Theorem 24 we listed all sets of parameters of the form [[n, n — 2d + 2, d]] for which 
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an additive code exists, and remarked that in each case the code is unique. In []56| this result 
is extended to nonadditive codes. In particular, any 

((2,1,2)),((4,4,2)),((5,2,3)),((6,1,4)) 

code is equivalent to the unique 

[[2, 0,2]], [[4, 2, 2]], [[5, 1,3]], [[6, 0,4]] 

additive code, respectively. On the other hand, for all n > 2, there exists a nonadditive 
((2n,2 2n " 2 ,2)) code. 

(xv) There is a remarkable story behind this paper. About a year and a half ago one of 
us (P.W.S.) was studying fault-tolerant quantum computation, and was led to investigate a 
certain group of 8 x 8 orthogonal matrices. P.W.S. asked another of us (N.J.A.S.) for the 
best method of computing the order of this group. N.J.A.S. replied by citing the computer 



algebra system MAGMA ||, ||, [10], and gave as an illustration the MAGMA commands 
needed to specify a certain matrix group that had recently arisen in connection with packings 
in Grassmannian spaces. This group was the symmetry group of a packing of 70 4-dimensional 



subspaces of R 8 that had been discovered by computer search [22]. It too was an 8-dimensional 
group, of order 5160960. To our astonishment the two groups turned out to be identical (not 
just isomorphic)! We then discovered that this group was a member of an infinite family of 



groups that played a central role in a joint paper [12| of another of the authors (A.R.C.). 
This is the family of real Clifford groups Lr, described in Section 2 (for n = 3, Lr has order 
5160960). 

This coincidence led us to make connections which further advanced both areas of research 



(fault-tolerant quantum computing [61] and Grassmannian packings |63|). 

While these three authors were pursuing these investigations, the fourth author (E.M.R.) 
happened to be present for a job interview and was able to make further contributions to 
the Grassmannian packing problem jDj]. As the latter involved packings of 2 fc -dimensional 
subspaces in 2 n -dimensional space, it was natural to ask if the same techniques could be used 
for constructing quantum-error-correcting codes, which are also subspaces of 2 n -dimensional 



space. This question led directly to [|16| and the present paper. (Incidentally, he got the job.) 

A final postscript: At the 1997 IEEE International Symposium on Information Theory, 
V. I. Sidelnikov presented a paper "On a finite group of matrices generating orbit codes on the 
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Euclidean sphere" (6l| (based on |64fl , plfl ). It was no surprise to discover that — although 
Sidelnikov did not identify them in this way — these were the Clifford groups appearing in yet 
another guise. 
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